---
title: "Registered apps description"
canonical: "https://docs.cuesystem.com/space/M3SG/255819944/Registered%20apps%20description"
format: markdown
---
This chapter describes registered apps for Microsoft Graph API.
Microsoft Graph is a Microsoft developer platform that connects services and devices. It permits to integration CUE Solution services with Microsoft 365 and Azure. App for MS Graph must be registered with Azure AD. Registering your app establishes a unique application ID and other values that your app uses to authenticate with Azure AD and get tokens.
For communication with Microsoft 365, the CUE Solution requires the setting of up to five [Connection agents](https://docs.cuesystem.com/space/TAM/18579457/Connection+agents).
> ⚠️ It is recommended to create a **dedicated registered application for each connection agent** according to the following description.
> ℹ️ The **number of applications can be reduced **when using CUE Solution, but the minimum number is **two**:
> ℹ️
> ℹ️ - Azure AD application **for apps** (formerly for CUE Assist)
> ℹ️ - **Common** app for other connection agents.
> ⚠️ If you use **[Essential Setup](/wiki/spaces/TES/overview#Essential-Setup)** or **[touchONE-manager](/wiki/spaces/TOA/overview#touchONE-manager-On-premises-Administration)** to manage the reservation system, you only need to create a **[App For units](/wiki/spaces/M3SG/pages/255819944/Registered+apps+description#App-For-units)**. No other apps are required.
# Common app for more connection agents
This application can be used for the following connection agents:
- For sending email
- For import resources and users
- For API operations
- For units.
**Disadvantages **of using a common app for multiple agents are as follows:
- **Combination of permissions**
Delegated API permissions required for each connection agent must be combined in one registered application. Permissions are thus under less control and this is not recommended.
- **Throttling**
Since there is a limitation in access to Microsoft 365 using Microsoft Graph to a maximum of 10 000 communication transactions per 10 minutes for a unique combination of registered application and service account, one service account used together with the one registered application is suitable for up to 50 touchONE devices. If you need to use more devices, use another service account or create another registered application for every 50 devices.
If you decide to use the common app, the **parameters **must be set as follows:
| | Device code flow | Resource Owner Password Credentials |
| --- | --- | --- |
| Required delegated API permissions | - offline_access
- Calendars.Read
- Calendars.Read.Shared
- Calendars.ReadWrite
- Calendars.ReadWrite.Shared
- Group.Read.All1
- GroupMember.Read.All1
- Mail.Send
- Place.Read.All
- User.Read
- User.ReadBasic.All | - Calendars.Read
- Calendars.Read.Shared
- Calendars.ReadWrite
- Calendars.ReadWrite.Shared
- Group.Read.All1
- GroupMember.Read.All1
- Mail.Send
- Place.Read.All
- User.Read
- User.ReadBasic.All |
| Admin consent | Depends on Microsoft 365 security policy settings. | Required |
| Client secret | Not required | Required |
| Allow public client flows | Required | Not required |
| Redirect URIs | Not required | Not required |
> Macro (excerpt-include)
## App For sending email
The **mandatory **application is used to send various emails from the CUE server.
> 📝 For the "For sending emails" connection agent it is possible to use an **SMTP server** instead of this registered application. The decision is up to the system administrator. If SMTP server is used, no setup in Microsoft 365 is required.
The parameters must be set as follows:
| | Device code flow | Resource Owner Password Credentials |
| --- | --- | --- |
| Required delegated API permissions | - offline_access
- Mail.Send
- User.Read | - Mail.Send
- User.Read |
| Admin consent | Depends on Microsoft 365 security policy settings. | Required |
| Client secret | Not required | Required |
| Allow public client flows | Required | Not required |
| Redirect URIs | Not required | Not required |
## App For import resources and users
This application is used to read the list of users and resources from the AD server and synchronize it with the CUE server.
The parameters must be set as follows:
| | Device code flow | Resource Owner Password Credentials |
| --- | --- | --- |
| Required delegated API permissions | - offline_access
- Calendars.Read.Shared
- Group.Read.All1
- GroupMember.Read.All1
- Place.Read.All
- User.Read
- User.ReadBasic.All | - Calendars.Read.Shared
- Group.Read.All1
- GroupMember.Read.All1
- Place.Read.All
- User.Read
- User.ReadBasic.All |
| Admin consent | Depends on Microsoft 365 security policy settings. | Required. |
| Client secret | Not required | Required |
| Allow public client flows | Required | Not required |
| Redirect URIs | Not required | Not required |
> Macro (excerpt-include)
## App For API operations
This application is used for CUE server background operations such as reading and confirming reservations, processing analytics data, processing of the orders from CUE Assist app, caching/prefetching calendar data for CUE Assist.
The parameters must be set as follows:
| | Device code flow | Resource Owner Password Credentials |
| --- | --- | --- |
| Required delegated API permissions | - offline_access
- Calendars.ReadWrite
- Calendars.ReadWrite.Shared
- User.Read | - Calendars.ReadWrite
- Calendars.ReadWrite.Shared
- User.Read |
| Admin consent | Depends on Microsoft 365 security policy settings. | Required. |
| Client secret | Not required | Required |
| Allow public client flows | Required | Not required |
| Redirect URIs | Not required | Not required |
## App For units
This application is used for CUE Solution Units (panels, touchONE-overview and touchONE-manager) communication with resource calendars and for sending emails (e.g. with service requests).
> ⚠️ If you use **[Essential Setup](/wiki/spaces/TES/overview#Essential-Setup)** or **[touchONE-manager](/wiki/spaces/TOA/overview#touchONE-manager-On-premises-Administration)** to manage the reservation system, the **App For units** is the only app you need to create.
The parameters must be set as follows:
| | Device code flow | Resource Owner Password Credentials |
| --- | --- | --- |
| Required delegated API permissions | - offline_access
- Calendars.ReadWrite
- Calendars.ReadWrite.Shared
- Mail.Send
- User.Read | - Calendars.ReadWrite
- Calendars.ReadWrite.Shared
- Mail.Send
- User.Read |
| Admin consent | Depends on Microsoft 365 security policy settings. | Required. |
| Client secret | Not required | Required |
| Allow public client flows | Required | Not required |
| Redirect URIs | Not required | Not required |
## App For apps (formerly for CUE Assist)
This application is used in CUE Assist application and Outlook add-in CUE Addin to communicate with external calendar servers and for user login and authentication. Can also be used to log in touchONE-admin users if Microsoft 365 identity authentication is required.
The parameters must be set as follows:
| | Implicit Grant Flow
(CUE Solution to version 5) | Authorization Code Flow
(CUE Solution from version 6) |
| --- | --- | --- |
| Required delegated API permissions | - email
- openid
- profile
- Calendars.Read.Shared
- Calendars.ReadWrite
- Calendars.ReadWrite.Shared
- Calendars.Read
- Contacts.Read
- Contacts.Read.Shared
- Group.Read.All2
- User.ReadBasic.All | - email
- **offline_access**
- openid
- profile
- Calendars.Read.Shared
- Calendars.ReadWrite
- Calendars.ReadWrite.Shared
- Calendars.Read
- Contacts.Read
- Contacts.Read.Shared
- Group.Read.All2
- User.ReadBasic.All |
| Admin consent | Depends on Microsoft 365 security policy settings. | Depends on Microsoft 365 security policy settings. |
| Client secret | Not required | Required |
| Allow public client flows | Required | Not required |
| Redirect URIs | Required | Required |
> Macro (excerpt-include)
## Notes on application parameters
**Admin consent**
- **Depends on Microsoft 365 security policy settings**
Whether individual permissions require administrator approval depends on the security policy of the tenant. Device Code Flow, Implicit Grant Flow and Authorization Code Flow uses interactive sign-in. This means that permissions can be granted by the user the first time the application is sign-in. However, it is possible that the set security policy does not allow user approval of permissions and requires admin consent.
- **Required**
Because ROPC does not use interactive sign-in, all permissions must be granted by the administrator.
## Apps & administration methods
Registered applications can be used for various administration methods as described in the following table.
| Registered app | CUE Admin
administration | touchONE-manager
administration | touchONE-concentrator
administration | Essential setup
administration |
| --- | --- | --- | --- | --- |
| For sending email | **✓** | | | |
| For import resources and users | **✓** | | | |
| For API operations | **✓** | | | |
| For units | **✓** | **✓** | **✓** | **✓** |
| For apps | **✓** | | | |